Extracting Facebook passwords from memory image or hibernation file

Passware Kit 12.3 recovers passwords for Facebook, Gmail, and other websites by analyzing a memory image or a system hibernation file.

Here is how it’s done.

Launch Google Chrome browser on a target machine and open a new Incognito window (Ctrl+Shift+N). In Incognito mode Chrome does not save your passwords, but still they are present in computer memory.

Fill in email and password and click Log In:

Close Google Chrome. Now you can put your computer into hibernation or create a memory image.

When a computer hibernates, Windows writes all the physical RAM memory contents to C:\hiberfil.sys file, creating a memory image. As hiberfil.sys file is locked by Windows, you might need to use special tools in order to access the file. You can follow detailed instructions on creating a copy of the hibernation file.